Which Meterpreter command dumps the local SAM database to the screen?

• A. Timestomp
• B. Hashdump
• C. Ps
• D. Getpid

Answer: (B)

The local Security Account Manager (SAM) database contains the password hashes for local Windows accounts. The hashdump command in Meterpreter reads that SAM data (and related sources) and prints the retrieved account hashes to the screen. This is exactly what you need when you want to obtain password hashes for offline cracking or pass-the-hash tactics. The other commands perform different tasks: timestomp alters file timestamps, ps lists running processes, and Get-PID shows the Meterpreter process ID. So hashdump is the command that directly dumps the SAM hashes to the screen.